KEYCORP /NEW/

The following discussion provides a summary of recent regulatory developments and should be read in conjunction with the disclosure included in our 2024 Form 10-K under the heading “Supervision and Regulation” in Item 1. Business and under the heading “V. Compliance Risk” in Item 1A. Risk Factors as well as the disclosure included in Part II, Item 1A. "Risk Factors" of this report.

Regulatory capital requirements

KeyCorp and KeyBank are subject to regulatory capital requirements that are based largely on the Basel III international capital framework (“Basel III”). The Basel III capital framework and the U.S. implementation of the Basel III capital framework (“Regulatory Capital Rules”) are discussed in more detail in Item 1. Business of our 2024 Form 10-K under the heading “Supervision and Regulation — Regulatory capital requirements.”

Under the Regulatory Capital Rules, standardized approach banking organizations, such as KeyCorp and KeyBank, are required to meet the minimum capital and leverage ratios set forth in Figure 1 below. At June 30, 2025, KeyCorp’s ratios under the fully phased-in Regulatory Capital Rules were as set forth in Figure 1.

Figure 1. Minimum Capital Ratios and KeyCorp Ratios Under the Regulatory Capital Rules

(a)As a standardized approach banking organization, KeyCorp is not subject to the 3% supplementary leverage ratio requirement. However, KeyCorp will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

(b)Stress capital buffer must consist of Common Equity Tier 1 capital. As a standardized approach banking organization, KeyCorp is not subject to the countercyclical capital buffer of up to 2.5% imposed upon an advanced approaches banking organization under the Regulatory Capital Rules. However, KeyCorp will be subject to the countercyclical capital buffer if proposed revisions to the Regulatory Capital Rules are adopted.

(c)June 30, 2025 capital ratios are estimates

Revised prompt corrective action framework

The federal Prompt Corrective Action (“PCA”) framework under the FDIA groups FDIC-insured depository institutions into one of five prompt corrective action capital categories: “well capitalized,” “adequately capitalized,” “undercapitalized,” “significantly undercapitalized,” and “critically undercapitalized.” In addition to implementing the Basel III capital framework in the United States, the Regulatory Capital Rules also revised the PCA capital category threshold ratios applicable to FDIC-insured depository institutions such as KeyBank. The revised PCA framework table in Figure 2 identifies the capital category threshold ratios for a “well capitalized” and an “adequately capitalized” institution under the PCA Framework.

Figure 2. "Well Capitalized" and "Adequately Capitalized" Capital Category Ratios under Revised Prompt Corrective Action Framework

(a)A “well capitalized” institution also must not be subject to any written agreement, order, or directive to meet and maintain a specific capital level for any capital measure.

(b)As a “standardized approach” banking organization, KeyBank is not subject to the 3% supplementary leverage ratio requirement, which became effective January 1, 2018. However, KeyBank will be subject to the supplementary leverage ratio if proposed revisions to the Regulatory Capital Rules are adopted.

As of June 30, 2025, KeyBank (consolidated) satisfied the risk-based and leverage capital requirements necessary to be considered “well capitalized” for purposes of the revised prompt corrective action framework. However, investors should not regard this determination as a representation of the overall financial condition or prospects of KeyBank because the PCA framework is intended to serve a limited supervisory function. Moreover, it is important to note that the PCA framework does not apply to BHCs, like KeyCorp.

Capital planning and stress testing

KeyCorp is a Category IV banking organization subject to a supervisory stress test every other year. On June 26, 2024, the Federal Reserve announced the results of the supervisory stress test that it conducted of 31 BHCs having more than $100 billion in total consolidated assets (including KeyCorp). The Federal Reserve indicated that all BHCs subject to the stress test maintained capital ratios above the minimum required levels under the severely adverse scenario. The stress test results for individual BHCs (including KeyCorp) were used by the Federal Reserve to determine a BHC’s updated stress capital buffer requirement. The Federal Reserve published the updated stress capital buffer requirements on August 28, 2024. KeyCorp’s updated stress capital buffer is 3.1%. This stress capital buffer became effective on October 1, 2024 and will remain in effect until September 30, 2025, unless KeyCorp later receives an updated stress capital buffer requirement from the Federal Reserve.

On June 27, 2025, the Federal Reserve announced the results of the supervisory stress test that it conducted of 22 large BHCs (not including KeyCorp). As a Category IV banking organization subject to a supervisory stress test every other year, KeyCorp was not required to participate in the Federal Reserve’s supervisory stress test in 2025.

See Item 1. Business of our 2024 Form 10-K under the heading “Supervision and Regulation - Regulatory capital requirements - Capital planning and stress testing” for a discussion of other developments concerning capital planning and stress testing requirements.

Proposed updates to LFI Rating System

On July 10, 2025, the Federal Reserve issued for public comment a proposal to revise its Large Financial Institution Rating System (the “LFI Rating System”) that applies to BHCs with total consolidated assets of $100 billion or more, including KeyCorp. The proposal would revise the component ratings that a firm must receive to be considered “well managed.” A firm that is not “well managed” faces limitations on certain activities and acquisitions. The Federal Reserve said that the proposed revisions are intended to provide a more accurate assessment of a BHC’s financial and operational strength and resilience and better align the LFI Rating System with the rating systems used for other banking organizations. Comments on the proposal are due 30 days after publication in the Federal Register, or August 14, 2025.

Deposit insurance and assessments

The DIF provides insurance coverage for domestic deposits funded through assessments on insured depository institutions like KeyBank. The amount of deposit insurance coverage for each depositor’s deposits is $250,000 per depository.

The FDIC must assess the premium based on an insured depository institution’s assessment base, calculated as its average consolidated total assets minus its average tangible equity. KeyBank’s current annualized premium assessments can range from $0.025 to $0.45 for each $100 of its assessment base. The rate charged depends on KeyBank’s performance on the FDIC’s “large and highly complex institution” risk-assessment scorecard, which includes factors such as KeyBank’s regulatory rating, its ability to withstand asset and funding-related stress, and the relative magnitude of potential losses to the FDIC in the event of KeyBank’s failure.

See Item 1. Business of our 2024 Form 10-K under the heading “Supervision and Regulation – FDIA, Resolution Authority and Financial Stability - Deposit insurance and assessments” for a discussion of other developments concerning deposit insurance and assessments.

Consumer Financial Protection Bureau

The CFPB, which was created by the Dodd-Frank Act in 2010, was given the authority by that statute to regulate the offer and sale of consumer financial products and services, enforce federal consumer protection laws, and supervise certain providers of consumer financial products and services, including banks with over $10 billion in assets (such as KeyBank). The Trump administration has announced its intention to close the CFPB and has taken various actions to accomplish that objective, including issuing a stop work order to CFPB employees, terminating many CFPB employees, placing other CFPB employees on administrative leave, and significantly reducing the CFPB’s annual funding through legislation. A union representing the CFPB’s employees and other interested parties brought a lawsuit in the United States District Court for District of Columbia, seeking a court order to stop the Trump administration from dismantling the CFPB. On March 25, 2025, the court in that case issued a preliminary injunction, which enjoined the Trump administration from taking actions to dismantle the CFPB. The Trump administration has appealed this court order. On April 11, 2025, the United States Court of Appeals for the District of Columbia Circuit denied, in large part, a request by the Trump administration to stay the preliminary injunction while the appeal is pending, but the court ruled that the administration would be allowed to terminate some CFPB employees before the appeal is resolved by making particularized assessments that those employees are not necessary to carry out the agency’s statutory duties. Key is monitoring developments in this case.

Data collection and reporting for small business loans

On March 30, 2023, the CFPB issued a final rule to require certain lenders (including depository institutions such as KeyBank) to report detailed data on applications for credit submitted by small businesses, including those owned by women and minorities. This rule was issued to implement Section 1071 of the Dodd-Frank Act. Various lawsuits were brought to challenge this rule. In one of these lawsuits, the CFPB, on April 3, 2025, asked the court to hold the lawsuit in abeyance because the CFPB planned to issue a new proposed rulemaking on this subject. Key is monitoring developments in this case. In that case and two other cases challenging the 1071 rule, courts stayed compliance with the rule for the parties in those cases. On June 18, 2025, the CFPB issued an interim final rule delaying compliance with the 1071 rule for all institutions covered by the rule. The CFPB extended the compliance dates by approximately one year so that the highest volume lenders would not have to begin collecting data in accordance with the 1071 rule until July 1, 2026, and the moderate and smallest volume lenders would not have to begin collecting such data until January 1, 2027, and October 1, 2027, respectively. Comments on the interim final rule were due by July 18, 2025. Key is monitoring developments regarding the status of the 1071 rule.

Personal financial data rights

On October 22, 2024, the CFPB issued a final rule to implement Section 1033 of the Dodd-Frank Act. The 1033 rule requires financial institutions (including KeyBank) to make available to consumers and authorized third parties data concerning covered consumer financial products or services in an electronic form usable by the consumer and authorized third parties. In adopting the rule, the CFPB said that the 1033 rule was a step towards bringing about an “open banking” system in the United States. Following the issuance of this rule, two trade associations and a national bank filed a lawsuit challenging the rule in the United States District Court for the Eastern District of Kentucky. In this lawsuit, the plaintiffs alleged that the CFPB exceeded its statutory authority in adopting the 1033 rule. On May 23, 2025, the CFPB filed a status report with the court saying that it agreed with the plaintiffs that the 1033 rule exceeded the agency’s statutory authority. On May 30, 2025, the parties challenging the rule and the CFPB filed a motion for summary judgment asking the court to invalidate the rule. In a summary judgment motion filed on June 29, 2025, the Financial Technology Association, which had been allowed to intervene in this case, asked the court to uphold the rule. Key is monitoring developments in this case.